xen, selinux, FC5

[Robin Bowes]

Stephen Smalley wrote:
> On Fri, 2006-10-13 at 19:51 +0100, Robin Bowes wrote:
>> allow xm_t fixed_disk_device_t:blk_file read;
> 
>>From the above, you are still directly allowing read access to a fixed
> disk device rather than using the storage_raw_read_fixed_disk()
> interface.  IOW, replace your 'allow xm_t fixed_disk_device_t:blk_file
> read;' statement with:
> 	storage_raw_read_fixed_disk(xm_t)

Ah, right. That was what I was missing.

I removed that line and ran the make and got these errors:

]# make -f /usr/share/selinux/devel/Makefile
Compiling targeted xen module
/usr/bin/checkmodule:  loading policy configuration from tmp/xen.tmp
xen.te:40:ERROR 'permission read is not defined for class dir' at token
';' on line 59080:
        allow xm_t device_t:dir { read getattr lock search ioctl };
#line 40
xen.te:40:ERROR 'permission getattr is not defined for class dir' at
token ';' on line 59080:
        allow xm_t device_t:dir { read getattr lock search ioctl };
#line 40
xen.te:40:ERROR 'permission lock is not defined for class dir' at token
';' on line 59080:
        allow xm_t device_t:dir { read getattr lock search ioctl };
#line 40
xen.te:40:ERROR 'permission ioctl is not defined for class dir' at token
';' on line 59080:
        allow xm_t device_t:dir { read getattr lock search ioctl };
#line 40
xen.te:40:ERROR 'unknown class lnk_file used in rule' at token ';' on
line 59082:
        allow xm_t device_t:lnk_file { getattr read };
#line 40
/usr/bin/checkmodule:  error(s) encountered while parsing configuration
make: *** [tmp/xen.mod] Error 1

So, I removed all the lines I put in relating to the raw read. My xen.te
now looks like this:

module local 1.0;

require {
        class chr_file { read write };
        class dir { add_name create search setattr write };
        class fd use;
        class file { append create read write };
        class unix_stream_socket { read write };
        type home_root_t;
        type ifconfig_t;
        type local_login_t;
        type netutils_t;
        type proc_xen_t;
        type tmp_t;
        type tty_device_t;
        type user_home_dir_t;
        type user_home_t;
        type var_log_t;
        type var_run_t;
        type xend_t;
        type xend_var_log_t;
        role system_r;
};

allow ifconfig_t var_log_t:file append;
allow netutils_t proc_xen_t:file { read write };
allow netutils_t xend_t:unix_stream_socket { read write };
allow netutils_t xend_var_log_t:file { append write };
allow xend_t home_root_t:dir { search write };
allow xend_t local_login_t:fd use;
allow xend_t tmp_t:dir search;
allow xend_t tty_device_t:chr_file { read write };
allow xend_t user_home_dir_t:dir { search write };
allow xend_t user_home_t:dir { add_name search write };
allow xend_t user_home_t:file { create write };
allow xend_t var_run_t:dir { create setattr };
storage_raw_read_fixed_disk(xm_t)


Running the make produces this error:

# make -f /usr/share/selinux/devel/Makefile
Compiling targeted xen module
/usr/bin/checkmodule:  loading policy configuration from tmp/xen.tmp
xen.te:37:ERROR 'unknown type xm_t' at token ';' on line 59091:
#line 37
        typeattribute xm_t fixed_disk_raw_read;
/usr/bin/checkmodule:  error(s) encountered while parsing configuration
make: *** [tmp/xen.mod] Error 1


I tried putting back "type xm_t" but get these errors:

# make -f /usr/share/selinux/devel/Makefile
Compiling targeted xen module
/usr/bin/checkmodule:  loading policy configuration from tmp/xen.tmp
xen.te:38:ERROR 'permission read is not defined for class dir' at token
';' on line 59078:
        allow xm_t device_t:dir { read getattr lock search ioctl };
#line 38
xen.te:38:ERROR 'permission getattr is not defined for class dir' at
token ';' on line 59078:
        allow xm_t device_t:dir { read getattr lock search ioctl };
#line 38
xen.te:38:ERROR 'permission lock is not defined for class dir' at token
';' on line 59078:
        allow xm_t device_t:dir { read getattr lock search ioctl };
#line 38
xen.te:38:ERROR 'permission ioctl is not defined for class dir' at token
';' on line 59078:
        allow xm_t device_t:dir { read getattr lock search ioctl };
#line 38
xen.te:38:ERROR 'unknown class lnk_file used in rule' at token ';' on
line 59080:
        allow xm_t device_t:lnk_file { getattr read };
#line 38
/usr/bin/checkmodule:  error(s) encountered while parsing configuration
make: *** [tmp/xen.mod] Error 1

I found I had to add all the missing classes and permissions.

This version of xen.te builds and installs cleanly:

module local 1.0;

require {
        class blk_file { read getattr lock ioctl };
        class chr_file { read write };
        class dir { add_name create search setattr write read getattr
lock ioctl };
        class fd use;
        class file { append create read write };
        class lnk_file { getattr read };
        class unix_stream_socket { read write };
        type home_root_t;
        type ifconfig_t;
        type local_login_t;
        type netutils_t;
        type proc_xen_t;
        type tmp_t;
        type tty_device_t;
        type user_home_dir_t;
        type user_home_t;
        type var_log_t;
        type var_run_t;
        type xend_t;
        type xend_var_log_t;
        type xm_t;
        role system_r;
};

allow ifconfig_t var_log_t:file append;
allow netutils_t proc_xen_t:file { read write };
allow netutils_t xend_t:unix_stream_socket { read write };
allow netutils_t xend_var_log_t:file { append write };
allow xend_t home_root_t:dir { search write };
allow xend_t local_login_t:fd use;
allow xend_t tmp_t:dir search;
allow xend_t tty_device_t:chr_file { read write };
allow xend_t user_home_dir_t:dir { search write };
allow xend_t user_home_t:dir { add_name search write };
allow xend_t user_home_t:file { create write };
allow xend_t var_run_t:dir { create setattr };
storage_raw_read_fixed_disk(xm_t)


> That was the point of switching to using the devel Makefile, so that you
> could use the above interface.  Which already expands to the necessary
> declarations and rules to allow the access without violating the
> assertion/neverallow rule.
> 
> There isn't anything magic here; it is just that
> storage_raw_read_fixed_disk() as defined
> in /usr/share/selinux/devel/include/kernel/storage.if already expands to
> the right set of rules, and by using it, you insulate yourself from the
> policy details that might change over time or between systems.  Same
> thing applies to all of your rules; if there is already an interface for
> that purpose, you are better off using it.  

So, how do I find out more about this? How would I know that interfaces
like storage_raw_read_fixed_disk(xm_t) exist, and what they mean?

Thanks for all your help,

R.